A "Certificate Request" from the server should appear between the "Server Hello" and "Server Hello Done" messages and can be located using a display filter of tls.handshake.type == 13.